How configure freeradius that check user group in Microsoft Active Direcory
Hi I integrated freeradius with Microsoft Active Directory All users in Active Directory have access. How I will set freeradius that check users groups nad access accept if user belongs to groups WIFI in Active Directory.
matrix30003 wrote:
Hi I integrated freeradius with Microsoft Active Directory All users in Active Directory have access. How I will set freeradius that check users groups nad access accept if user belongs to groups WIFI in Active Directory.
Configure AD as an LDAP server. Use the LDAP-Group attribute for membership checking. Alan DeKok.
Hi My precise configuration: I used MS AD as for user store. I used samba and ntlm_auth to integration with AD. Where I will find options about checking group from AD. 2014/1/23 matrix30003 <matrix30003@gmail.com>
Hi I integrated freeradius with Microsoft Active Directory All users in Active Directory have access. How I will set freeradius that check users groups nad access accept if user belongs to groups WIFI in Active Directory.
Hi Am 23.01.2014 21:17, schrieb matrix30003:
Hi My precise configuration: I used MS AD as for user store. I used samba and ntlm_auth to integration with AD. Exactly that's the authentication part you are doing.
Where I will find options about checking group from AD. What you are looking for is is looking up if user X is member in group x or has attribute y, then do $thing which is uthorization. (which is likely at first grant or not grant acccess)
Look at http://wiki.freeradius.org/modules/Rlm_ldap Configure the ldap module and then look at the group support section on the page for i.e. configuration in the post-auth section. 2 AD-specific gotchas: - AD always needs authenticated binds so you need to specify a user FreeRADIUS can authenticate against the AD LDAP to do queries. - AD supports nested groups which requires extra attention if you rely on them. Look out for LDAP_MATCHING_RULE_IN_CHAIN in conjuction with FreeRADIUS. -- Mat
On 23/01/14 20:56, Mathieu Simon (Lists) wrote:
2 AD-specific gotchas:
I will add a 3rd - primary group does not appear in memberOf, so you can't query it very easily.
- AD supports nested groups which requires extra attention if you rely on them. Look out for LDAP_MATCHING_RULE_IN_CHAIN in conjuction with FreeRADIUS.
Hey that is both new to me and really neat; someone should update the FR wiki and/or default configs with an example.
Am 23.01.2014 22:34, schrieb Phil Mayers:
On 23/01/14 20:56, Mathieu Simon (Lists) wrote:
2 AD-specific gotchas:
I will add a 3rd - primary group does not appear in memberOf, so you can't query it very easily. Right, did you find a way to do this even less easily?
- AD supports nested groups which requires extra attention if you rely on them. Look out for LDAP_MATCHING_RULE_IN_CHAIN in conjuction with FreeRADIUS.
Hey that is both new to me and really neat; someone should update the FR wiki and/or default configs with an example.
I've only stumbled across this post and realized that this can become handy not only in the context of FreeRADIUS - I've used it in a rather small AD environment - and currently seems to fulfill it's duty. I originally found it here: http://linax.wordpress.com/2012/07/17/freeradius-check-nested-ldap-group-mem... Yes, having it in the Wiki or default configs would be cool in case, currently I can only confirm that it worked for me. -- Mat
Am 24.01.2014 15:00, schrieb Alan DeKok:
Mathieu Simon (Lists) wrote:
Yes, having it in the Wiki or default configs would be cool in case, currently I can only confirm that it worked for me.
The Wiki *is* editable. For a reason.
Similarly, we accept patches to the default config.
Thanks Alan, actually this question brought back into my mind that I had that somewhere in a infra documentation. Since the freeradius wiki represents often good known examples on what to do - also on what NOT - there is good reason to ask for opinion of "elder" who might know (performance?) before changing for worse. You, Arran et al. often come up with things only more experienced people actually might consider. -- Mat
I have posted this before and the response I got was "If the server sends an Access-Accept and the user doesn't get online....blame the NAS. Always". I am having a situation where the connection just broke without any config change. We have two alternate RADIUS servers (Main one and a back up) both receiving packets from the same NAS. I returned to the office after the week end to find users are not getting online in spite of the Main RADIUS server returning Access-Accept (This has always been working and there has been no config change on the NAS and Radius servers). I changed the same NAS to connect to the Backup RADIUS server and everything works. I can't figure out how NAS is to blame here please! Below is the extract of post-authentication reply log from the Main RADIUS server to the NAS, but users are not getting online. 10.255.253.2 Returned from 193.62.48.61 for User xxxx - Tue Jan 28 09:51:57 2014 Packet-Type = Access-Accept MS-CHAP2-Success = 0x00533d44303538334343433436373339323643313033343843413135463643373637333639373241423130 MS-MPPE-Recv-Key = 0xc4c255e279235d1abc4128569b4391b6 MS-MPPE-Send-Key = 0x3773e3518d6620d5d8f85e158848c601 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 Many Thanks Clement
Network only allowing packets in one direction? -----Original Message----- From: freeradius-users-bounces+adrian.p.smith=bt.com@lists.freeradius.org [mailto:freeradius-users-bounces+adrian.p.smith=bt.com@lists.freeradius.org] On Behalf Of Clement Ogedengbe Sent: 28 January 2014 10:10 To: FreeRadius users mailing list Subject: RE: Access-Accept BUT no connection I have posted this before and the response I got was "If the server sends an Access-Accept and the user doesn't get online....blame the NAS. Always". I am having a situation where the connection just broke without any config change. We have two alternate RADIUS servers (Main one and a back up) both receiving packets from the same NAS. I returned to the office after the week end to find users are not getting online in spite of the Main RADIUS server returning Access-Accept (This has always been working and there has been no config change on the NAS and Radius servers). I changed the same NAS to connect to the Backup RADIUS server and everything works. I can't figure out how NAS is to blame here please! Below is the extract of post-authentication reply log from the Main RADIUS server to the NAS, but users are not getting online. 10.255.253.2 Returned from 193.62.48.61 for User xxxx - Tue Jan 28 09:51:57 2014 Packet-Type = Access-Accept MS-CHAP2-Success = 0x00533d44303538334343433436373339323643313033343843413135463643373637333639373241423130 MS-MPPE-Recv-Key = 0xc4c255e279235d1abc4128569b4391b6 MS-MPPE-Send-Key = 0x3773e3518d6620d5d8f85e158848c601 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 Many Thanks Clement - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Don't think so as I can ping the NAS from both RADIUS servers and there is no firewall between them. Also, the Backup RADIUS server that works with the NAS is on the same subnet with the Main RADIUS server that sends Access-Accept without user being able to get online. -----Original Message----- From: freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org] On Behalf Of adrian.p.smith@bt.com Sent: 28 January 2014 10:19 To: freeradius-users@lists.freeradius.org Subject: RE: Access-Accept BUT no connection Network only allowing packets in one direction? -----Original Message----- From: freeradius-users-bounces+adrian.p.smith=bt.com@lists.freeradius.org [mailto:freeradius-users-bounces+adrian.p.smith=bt.com@lists.freeradius.org] On Behalf Of Clement Ogedengbe Sent: 28 January 2014 10:10 To: FreeRadius users mailing list Subject: RE: Access-Accept BUT no connection I have posted this before and the response I got was "If the server sends an Access-Accept and the user doesn't get online....blame the NAS. Always". I am having a situation where the connection just broke without any config change. We have two alternate RADIUS servers (Main one and a back up) both receiving packets from the same NAS. I returned to the office after the week end to find users are not getting online in spite of the Main RADIUS server returning Access-Accept (This has always been working and there has been no config change on the NAS and Radius servers). I changed the same NAS to connect to the Backup RADIUS server and everything works. I can't figure out how NAS is to blame here please! Below is the extract of post-authentication reply log from the Main RADIUS server to the NAS, but users are not getting online. 10.255.253.2 Returned from 193.62.48.61 for User xxxx - Tue Jan 28 09:51:57 2014 Packet-Type = Access-Accept MS-CHAP2-Success = 0x00533d44303538334343433436373339323643313033343843413135463643373637333639373241423130 MS-MPPE-Recv-Key = 0xc4c255e279235d1abc4128569b4391b6 MS-MPPE-Send-Key = 0x3773e3518d6620d5d8f85e158848c601 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 Many Thanks Clement - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Below is the extract of post-authentication reply log from the Main RADIUS server to the NAS, but users are not getting online.
Compare the output of the backup and primary RADIUS servers.
10.255.253.2 Returned from 193.62.48.61 for User xxxx - Tue Jan 28 09:51:57 2014 Packet-Type = Access-Accept MS-CHAP2-Success = 0x00533d44303538334343433436373339323643313033343843413135463643373637333639373241423130 MS-MPPE-Recv-Key = 0xc4c255e279235d1abc4128569b4391b6 MS-MPPE-Send-Key = 0x3773e3518d6620d5d8f85e158848c601 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004
Then blame the NAS :) Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
The reply-log of the Main server and the backup server to the NAS is similar as below: (You could see that the same NAS (10.255.253.2) is involved in both connections. Reply from the backup server to the NAS -> with this user gets online ================================================================= 10.255.253.2 Returned from 193.62.48.60 for User xxxx - Tue Jan 28 09:19:35 2014 Packet-Type = Access-Accept MS-CHAP2-Success = 0x00533d44363743314134363437423344393546414538463137443441333743334335454134373036414433 MS-MPPE-Recv-Key = 0xd233362f60149491fff8e1009d0f7940 MS-MPPE-Send-Key = 0x2cb6ef890950e98f530dabec5dfffe91 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 Reply from the Main server to the NAS -> with this user UNABLE to get online ================================================================= 10.255.253.2 Returned from 193.62.48.61 for User xxxx - Tue Jan 28 09:51:57 2014 Packet-Type = Access-Accept MS-CHAP2-Success = 0x00533d44303538334343433436373339323643313033343843413135463643373637333639373241423130 MS-MPPE-Recv-Key = 0xc4c255e279235d1abc4128569b4391b6 MS-MPPE-Send-Key = 0x3773e3518d6620d5d8f85e158848c601 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 -----Original Message----- From: freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org [mailto:freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 28 January 2014 10:21 To: FreeRadius users mailing list Subject: Re: Access-Accept BUT no connection
Below is the extract of post-authentication reply log from the Main RADIUS server to the NAS, but users are not getting online.
Compare the output of the backup and primary RADIUS servers.
10.255.253.2 Returned from 193.62.48.61 for User xxxx - Tue Jan 28 09:51:57 2014 Packet-Type = Access-Accept MS-CHAP2-Success = 0x00533d44303538334343433436373339323643313033343843413135463643373637333639373241423130 MS-MPPE-Recv-Key = 0xc4c255e279235d1abc4128569b4391b6 MS-MPPE-Send-Key = 0x3773e3518d6620d5d8f85e158848c601 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004
Then blame the NAS :) Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Clement Ogedengbe wrote:
The reply-log of the Main server and the backup server to the NAS is similar as below: (You could see that the same NAS (10.255.253.2) is involved in both connections.
a) the NAS is broken b) the reply isn't getting back to the NAS. Those are pretty much your only choices. Alan DeKok.
On 28 Jan 2014, at 10:56, Clement Ogedengbe <c.ogedengbe@worc.ac.uk> wrote:
The reply-log of the Main server and the backup server to the NAS is similar as below: (You could see that the same NAS (10.255.253.2) is involved in both connections.
Reply from the backup server to the NAS -> with this user gets online ================================================================= 10.255.253.2 Returned from 193.62.48.60 for User xxxx - Tue Jan 28 09:19:35 2014 Packet-Type = Access-Accept MS-CHAP2-Success = 0x00533d44363743314134363437423344393546414538463137443441333743334335454134373036414433 MS-MPPE-Recv-Key = 0xd233362f60149491fff8e1009d0f7940 MS-MPPE-Send-Key = 0x2cb6ef890950e98f530dabec5dfffe91 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004
Reply from the Main server to the NAS -> with this user UNABLE to get online ================================================================= 10.255.253.2 Returned from 193.62.48.61 for User xxxx - Tue Jan 28 09:51:57 2014 Packet-Type = Access-Accept MS-CHAP2-Success = 0x00533d44303538334343433436373339323643313033343843413135463643373637333639373241423130 MS-MPPE-Recv-Key = 0xc4c255e279235d1abc4128569b4391b6 MS-MPPE-Send-Key = 0x3773e3518d6620d5d8f85e158848c601 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004
Hm, those look OK. I don't read MSHCAPv2 though, maybe someone who does can comment on whether they're actually OK. It's probably a network issue then, look at counters on the NAS. Verify timeout/malformed packet counters associated with the RADIUS hosts aren't incrementing. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
There's more than just the RADIUS stuff to consider. The RADIUS server is saying okay. .. but then the NAS itself will have policies and requirements. Eg if the WLAN/VLAN isn't operating correctly or mapped correctly. .. or DHCP not responding etc. Alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.
participants (8)
-
adrian.p.smith＠bt.com -
Alan Buxey -
Alan DeKok -
Arran Cudbard-Bell -
Clement Ogedengbe -
Mathieu Simon (Lists) -
matrix30003 -
Phil Mayers